blume 2.0.3 → 2.1.1

package/src/audit/checks/sitemap.ts

@@ -2,6 +2,7 @@ import { normalizeBasePath, stripBasePath } from "../../core/base-path.ts";
 import type { Diagnostic } from "../../core/types.ts";
 import { finding } from "../catalog.ts";
 import { pageSite } from "../locate.ts";
+import { redirectAt } from "../redirects.ts";
 import type { AuditContext, CheckModule } from "../types.ts";
 import { decodePath, normalizePath, siteOrigin } from "../url.ts";
 
@@ -100,9 +101,7 @@ const checkListedUrl = (
   );
   const page = context.byUrl.get(path);
   if (!page) {
-    const redirect = context.redirects.find(
-      (entry) => normalizePath(entry.from) === path
-    );
+    const redirect = redirectAt(context.redirects, path);
     return [
       finding(
         "BLUME_AUDIT_SITEMAP_BAD_URL",

package/src/audit/redirects.ts

@@ -1,3 +1,7 @@
+import {
+  isPatternPath,
+  patternDestination,
+} from "../core/redirect-patterns.ts";
 import type { RedirectResolution } from "./types.ts";
 import { normalizePath } from "./url.ts";
 
@@ -7,18 +11,6 @@ interface ConfiguredRedirect {
   status: number;
 }
 
-/**
- * Follow every configured redirect through to its destination, classifying what
- * it lands on.
- *
- * - `loop`   — the chain revisits a hop it has already been to. Never resolves.
- * - `broken` — the chain ends somewhere the build does not serve.
- * - `chain`  — it resolves, but through at least one intermediate redirect.
- * - `ok`     — one hop, straight to a real page.
- *
- * An external destination (`https://…`) is always `ok`: it's outside the site,
- * so there's no local page to check it against.
- */
 /**
  * A destination's page path: the part before any query string or fragment. A
  * redirect to `/guide#setup` or `/search?q=x` lands on the `/guide` / `/search`
@@ -30,6 +22,22 @@ const pathOnly = (value: string): string => {
   return cut === -1 ? value : value.slice(0, cut);
 };
 
+/**
+ * Follow every configured redirect through to its destination, classifying what
+ * it lands on.
+ *
+ * - `loop`    — the chain revisits a hop it has already been to. Never resolves.
+ * - `broken`  — the chain ends somewhere the build does not serve.
+ * - `chain`   — it resolves, but through at least one intermediate redirect.
+ * - `ok`      — one hop, straight to a real page.
+ * - `pattern` — a pattern (`/beta/:slug*`), which covers paths rather than
+ *   naming one, so there is no single chain to walk; {@link redirectAt}
+ *   resolves a path it covers.
+ *
+ * An external destination (`https://…`) is always `ok`: it's outside the site,
+ * so there's no local page to check it against. A hop onto a path a pattern
+ * covers continues through that pattern.
+ */
 export const resolveRedirects = (
   redirects: readonly ConfiguredRedirect[],
   /** Whether the build serves a normalized path — see `isServed`. */
@@ -39,9 +47,14 @@ export const resolveRedirects = (
   for (const redirect of redirects) {
     byFrom.set(normalizePath(redirect.from), redirect);
   }
+  const hopFrom = (path: string): string | undefined =>
+    byFrom.get(path)?.to ?? patternDestination(redirects, path);
 
   return redirects.map((redirect) => {
     const from = normalizePath(redirect.from);
+    if (isPatternPath(redirect.from)) {
+      return { ...redirect, chain: [from], outcome: "pattern" as const };
+    }
     const chain: string[] = [from];
     const seen = new Set<string>([from]);
     let current = redirect.to;
@@ -63,11 +76,11 @@ export const resolveRedirects = (
       }
       chain.push(next);
       seen.add(next);
-      const hop = byFrom.get(next);
-      if (!hop) {
+      const hop = hopFrom(next);
+      if (hop === undefined) {
         break;
       }
-      current = hop.to;
+      current = hop;
     }
 
     const destination = chain.at(-1) ?? from;
@@ -84,3 +97,21 @@ export const resolveRedirects = (
     };
   });
 };
+
+/**
+ * The configured redirect a path takes, for the checks that report a link,
+ * canonical, sitemap entry, or `hreflang` pointing through one: the exact
+ * redirect from that path, else the pattern covering it, its `to` filled in
+ * for this path.
+ */
+export const redirectAt = (
+  redirects: readonly RedirectResolution[],
+  path: string
+): { to: string } | undefined => {
+  const exact = redirects.find((entry) => normalizePath(entry.from) === path);
+  if (exact) {
+    return exact;
+  }
+  const to = patternDestination(redirects, path);
+  return to === undefined ? undefined : { to };
+};

package/src/audit/run.ts

@@ -12,6 +12,7 @@ import { CHECKS } from "./catalog.ts";
 import type { CheckId } from "./catalog.ts";
 import { assetChecks } from "./checks/assets.ts";
 import { contentChecks } from "./checks/content.ts";
+import { contrastChecks } from "./checks/contrast.ts";
 import { dnsAidChecks } from "./checks/dns-aid.ts";
 import { duplicateChecks } from "./checks/duplicates.ts";
 import { i18nChecks } from "./checks/i18n.ts";
@@ -51,6 +52,7 @@ const MODULES: CheckModule[] = [
   ogImageChecks,
   i18nChecks,
   assetChecks,
+  contrastChecks,
   sitemapChecks,
   robotsChecks,
   llmsChecks,
@@ -67,6 +69,8 @@ export interface AuditOptions {
   origin?: string;
   /** Probe outbound links (`--external`). */
   external?: boolean;
+  /** Outbound URLs not to probe (`--ignore`). */
+  ignore?: (url: string) => boolean;
   /** Only report these check ids or categories. */
   only?: string[];
   /** Suppress these check ids or categories. */
@@ -157,6 +161,7 @@ export const runAudit = async (options: AuditOptions): Promise<AuditResult> => {
       siteOrigin(project.config.deployment.options.site),
       normalizeBasePath(project.config.deployment.options.base)
     ),
+    ignore: options.ignore ?? (() => false),
     llms: crawl.llms,
     origin,
     pages: crawl.pages,

package/src/audit/types.ts

@@ -13,6 +13,7 @@ import type {
 export type AuditTier = "static" | "network" | "external";
 
 export type AuditCategory =
+  | "accessibility"
   | "content"
   | "duplicates"
   | "indexability"
@@ -110,7 +111,7 @@ export interface RedirectResolution {
   status: number;
   /** Every hop from `from` to the final target, inclusive. */
   chain: string[];
-  outcome: "ok" | "loop" | "broken" | "chain";
+  outcome: "ok" | "loop" | "broken" | "chain" | "pattern";
 }
 
 /** One urlset file behind a sitemap, for the per-file size limits. */
@@ -248,6 +249,8 @@ export interface AuditContext {
   robots: RobotsDoc | null;
   llms: LlmsDoc | null;
   thresholds: AuditThresholds;
+  /** Outbound URLs the external tier doesn't probe (`--ignore`). */
+  ignore: (url: string) => boolean;
 }
 
 /** One category's checks. Modules, not per-check closures — see catalog.ts. */

package/src/audit/url.ts

@@ -45,10 +45,11 @@ export type ResolvedHref =
   | { kind: "self-origin"; path: string; hash: string }
   /**
    * A path on this origin that lacks `deployment.base`. The host serves the
-   * whole build under the base, so nothing answers here — `path` is the path
-   * as requested, base missing.
+   * whole build under the base, so nothing in the build answers here — `path`
+   * is the path as requested, base missing. `absolute` when the href spelled
+   * out the origin: a full URL can name another app on the same host.
    */
-  | { kind: "outside-base"; path: string }
+  | { kind: "outside-base"; path: string; absolute: boolean }
   /** An absolute URL on another origin. */
   | { kind: "external"; url: string }
   /** In-page anchor, `mailto:`, `tel:`, `javascript:`, data URI — not a page link. */
@@ -139,7 +140,11 @@ export const resolveHref = (
     if (origin && parsed.origin === origin) {
       const served = decodePath(parsed.pathname);
       if (!underBase(deployBase, served)) {
-        return { kind: "outside-base", path: normalizePath(served) };
+        return {
+          absolute: true,
+          kind: "outside-base",
+          path: normalizePath(served),
+        };
       }
       return {
         hash: parsed.hash.slice(1),
@@ -171,7 +176,11 @@ export const resolveHref = (
   // (`./auth`) was resolved against the base-less page URL above, so it
   // inherits the page's base by construction.
   if (target.startsWith("/") && !underBase(deployBase, served)) {
-    return { kind: "outside-base", path: normalizePath(served) };
+    return {
+      absolute: false,
+      kind: "outside-base",
+      path: normalizePath(served),
+    };
   }
   return {
     hash: resolved.hash.slice(1),

package/src/blume-modules.d.ts

@@ -12,7 +12,18 @@ declare module "blume:search-client" {
   // biome-ignore lint/style/useImportType: ambient module must stay a global script
   // oxlint-disable-next-line typescript/consistent-type-imports
   type Fn = import("./components/layout/search/types.ts").SearchFn;
-  export const createSearch: () => Fn | Promise<Fn>;
+  type Options =
+    // biome-ignore lint/style/useImportType: ambient module must stay a global script
+    // oxlint-disable-next-line typescript/consistent-type-imports
+    import("./components/layout/search/types.ts").SearchClientOptions;
+  export const createSearch: (options?: Options) => Fn | Promise<Fn>;
+}
+
+declare module "blume:consent-client" {
+  /** Start the configured consent adapter's browser module (see `consentClientTemplate`); a no-op for one without. */
+  // oxlint-disable-next-line typescript/consistent-type-imports
+  type Consent = import("./components/layout/consent/types.ts").BlumeConsent;
+  export const startConsentClient: (consent: Consent) => void;
 }
 
 declare module "blume:ask" {

package/src/captcha/client.ts

@@ -0,0 +1,152 @@
+/**
+ * The browser half of the bot check: a fresh token for each question the
+ * assistant sends (both providers' tokens are single-use). The provider's
+ * script loads with the first question rather than with the page, and one
+ * widget serves every question after it: an invisible hCaptcha, or a
+ * Turnstile that only shows itself when it needs the reader to interact,
+ * in a small container at the foot of the viewport.
+ *
+ * The client router swaps `<body>` on every navigation, taking the container
+ * and its widget with it, so a question after a swap mounts a new one.
+ */
+import type { CaptchaSettings } from "./schema.ts";
+
+/** Each provider's script, rendering only when asked to. */
+export const CAPTCHA_SCRIPTS = {
+  hcaptcha: "https://js.hcaptcha.com/1/api.js?render=explicit",
+  turnstile:
+    "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit",
+} as const;
+
+/** What Blume asks a Turnstile widget for. */
+interface TurnstileRenderOptions {
+  appearance: "interaction-only";
+  callback: (token: string) => void;
+  "error-callback": () => void;
+  execution: "execute";
+  sitekey: string;
+}
+
+/** The slice of `window.turnstile` the check uses. */
+export interface TurnstileApi {
+  execute: (widget: string) => void;
+  render: (container: HTMLElement, options: TurnstileRenderOptions) => string;
+  reset: (widget: string) => void;
+}
+
+/** What Blume asks an hCaptcha widget for. */
+interface HcaptchaRenderOptions {
+  sitekey: string;
+  size: "invisible";
+}
+
+/** The slice of `window.hcaptcha` the check uses. */
+export interface HcaptchaApi {
+  execute: (
+    widget: string,
+    options: { async: true }
+  ) => Promise<{ response: string }>;
+  render: (container: HTMLElement, options: HcaptchaRenderOptions) => string;
+  reset: (widget: string) => void;
+}
+
+/** The window, with the providers' globals once their scripts ran. */
+type CaptchaWindow = Window & {
+  hcaptcha?: HcaptchaApi;
+  turnstile?: TurnstileApi;
+};
+
+/** A Turnstile token on its way. */
+interface PendingToken {
+  reject: (error: Error) => void;
+  resolve: (token: string) => void;
+}
+
+/** Get a token for the next question. */
+export type CaptchaTokenGetter = (settings: CaptchaSettings) => Promise<string>;
+
+/** A token getter with its own script, container, and widget. */
+export const createCaptchaClient = (): CaptchaTokenGetter => {
+  let loaded: Promise<void> | undefined;
+  let host: HTMLElement | undefined;
+  let widget: string | undefined;
+  let pending: PendingToken | undefined;
+
+  const load = (kind: CaptchaSettings["kind"]): Promise<void> => {
+    // oxlint-disable-next-line promise/avoid-new -- adapt the script tag's load events
+    loaded ??= new Promise<void>((resolve, reject) => {
+      const tag = document.createElement("script");
+      tag.async = true;
+      tag.src = CAPTCHA_SCRIPTS[kind];
+      tag.addEventListener("load", () => resolve());
+      tag.addEventListener("error", () => {
+        // Let the next question try again.
+        loaded = undefined;
+        reject(new Error(`The ${kind} script didn't load.`));
+      });
+      document.head.append(tag);
+    });
+    return loaded;
+  };
+
+  // The widget's container, mounted again when a swap took the last one.
+  const mount = (): HTMLElement => {
+    if (host?.isConnected) {
+      return host;
+    }
+    host = document.createElement("div");
+    host.className = "fixed bottom-4 left-1/2 z-[60] -translate-x-1/2";
+    host.dataset.blumeCaptcha = "";
+    document.body.append(host);
+    widget = undefined;
+    return host;
+  };
+
+  const turnstileToken = (api: TurnstileApi, siteKey: string) =>
+    // oxlint-disable-next-line promise/avoid-new -- adapt Turnstile's token callbacks
+    new Promise<string>((resolve, reject) => {
+      pending = { reject, resolve };
+      const target = mount();
+      if (widget === undefined) {
+        widget = api.render(target, {
+          appearance: "interaction-only",
+          callback: (token) => pending?.resolve(token),
+          "error-callback": () =>
+            pending?.reject(new Error("The Turnstile check failed.")),
+          execution: "execute",
+          sitekey: siteKey,
+        });
+      } else {
+        api.reset(widget);
+      }
+      api.execute(widget);
+    });
+
+  const hcaptchaToken = async (api: HcaptchaApi, siteKey: string) => {
+    const target = mount();
+    if (widget === undefined) {
+      widget = api.render(target, { sitekey: siteKey, size: "invisible" });
+    } else {
+      api.reset(widget);
+    }
+    const { response } = await api.execute(widget, { async: true });
+    return response;
+  };
+
+  return async (settings) => {
+    await load(settings.kind);
+    // SAFETY: CaptchaWindow only adds the providers' optional globals, each
+    // checked before use.
+    const { hcaptcha, turnstile } = window as CaptchaWindow;
+    if (settings.kind === "hcaptcha" && hcaptcha) {
+      return hcaptchaToken(hcaptcha, settings.siteKey);
+    }
+    if (settings.kind === "turnstile" && turnstile) {
+      return turnstileToken(turnstile, settings.siteKey);
+    }
+    throw new Error(`The ${settings.kind} script loaded without its API.`);
+  };
+};
+
+/** The page's token getter: one script and one widget per page load. */
+export const captchaToken = createCaptchaClient();

package/src/captcha/hcaptcha.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+
+import type { AdapterDescriptor } from "../core/adapter.ts";
+import { adapterDescriptorSchema } from "../core/adapter.ts";
+
+/** Options for {@link hcaptcha}. */
+export interface HcaptchaOptions {
+  /** The site key, from the hCaptcha dashboard. */
+  siteKey: string;
+}
+
+export const hcaptchaOptionsSchema = z.strictObject({
+  siteKey: z.string().min(1),
+});
+
+export type HcaptchaAdapter = AdapterDescriptor<"hcaptcha", HcaptchaOptions>;
+
+export const hcaptchaAdapterSchema = adapterDescriptorSchema(
+  "hcaptcha",
+  hcaptchaOptionsSchema
+);
+
+/** Where the assistant's route checks an hCaptcha token. */
+export const HCAPTCHA_VERIFY_URL = "https://api.hcaptcha.com/siteverify";
+
+/**
+ * hCaptcha, as an invisible check: most readers never see a challenge. The
+ * site key is public and goes to the browser; the secret the route checks
+ * tokens with comes from `HCAPTCHA_SECRET_KEY`.
+ */
+export const hcaptcha = (options: HcaptchaOptions): HcaptchaAdapter => ({
+  kind: "hcaptcha",
+  options,
+  requiredSecrets: ["HCAPTCHA_SECRET_KEY"],
+  runtimeDeps: [],
+});

package/src/captcha/index.ts

@@ -0,0 +1,28 @@
+/**
+ * Bot checks for the assistant (`ai.assistant.captcha` in `blume.config.ts`).
+ * The assistant gets a token from the check before each question and the
+ * generated route verifies it before calling the model:
+ *
+ * ```ts
+ * import { defineConfig } from "blume";
+ * import { turnstile } from "blume/captcha";
+ *
+ * export default defineConfig({
+ *   ai: {
+ *     assistant: {
+ *       enabled: true,
+ *       captcha: turnstile({ siteKey: "0x4AAAAAAA…" }),
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * Each factory returns a plain descriptor (see `core/adapter.ts`); the browser
+ * half is `client.ts`, the server half `verify.ts`.
+ */
+export type { AdapterDescriptor, JsonValue } from "../core/adapter.ts";
+export { hcaptcha } from "./hcaptcha.ts";
+export type { HcaptchaAdapter, HcaptchaOptions } from "./hcaptcha.ts";
+export type { CaptchaAdapter, CaptchaSettings } from "./schema.ts";
+export { turnstile } from "./turnstile.ts";
+export type { TurnstileAdapter, TurnstileOptions } from "./turnstile.ts";

package/src/captcha/schema.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+
+import { hcaptchaAdapterSchema } from "./hcaptcha.ts";
+import { turnstileAdapterSchema } from "./turnstile.ts";
+
+/**
+ * The configured bot check, as its factory returned it. Anything that isn't
+ * one fails with the adapter hint; an adapter's own option errors keep their
+ * messages.
+ */
+export const captchaAdapterSchema = z.discriminatedUnion(
+  "kind",
+  [hcaptchaAdapterSchema, turnstileAdapterSchema],
+  {
+    error:
+      'captcha takes one adapter — e.g. `captcha: turnstile({ siteKey })` or `captcha: hcaptcha({ siteKey })`, imported from "blume/captcha".',
+  }
+);
+
+export type CaptchaAdapter = z.output<typeof captchaAdapterSchema>;
+
+/** What the browser needs to run the check: never the secret. */
+export interface CaptchaSettings {
+  kind: CaptchaAdapter["kind"];
+  siteKey: string;
+}
+
+/** The public half of an adapter, for the data snapshot. */
+export const captchaSettings = (adapter: CaptchaAdapter): CaptchaSettings => ({
+  kind: adapter.kind,
+  siteKey: adapter.options.siteKey,
+});

package/src/captcha/turnstile.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+
+import type { AdapterDescriptor } from "../core/adapter.ts";
+import { adapterDescriptorSchema } from "../core/adapter.ts";
+
+/** Options for {@link turnstile}. */
+export interface TurnstileOptions {
+  /** The widget's site key, from the Cloudflare dashboard. */
+  siteKey: string;
+}
+
+export const turnstileOptionsSchema = z.strictObject({
+  siteKey: z.string().min(1),
+});
+
+export type TurnstileAdapter = AdapterDescriptor<"turnstile", TurnstileOptions>;
+
+export const turnstileAdapterSchema = adapterDescriptorSchema(
+  "turnstile",
+  turnstileOptionsSchema
+);
+
+/** Where the assistant's route checks a Turnstile token. */
+export const TURNSTILE_VERIFY_URL =
+  "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+
+/**
+ * Cloudflare Turnstile. The site key is public and goes to the browser; the
+ * secret key the route checks tokens with comes from `TURNSTILE_SECRET_KEY`.
+ * Set the widget to Invisible or Managed in the Cloudflare dashboard: most
+ * readers never see a challenge.
+ */
+export const turnstile = (options: TurnstileOptions): TurnstileAdapter => ({
+  kind: "turnstile",
+  options,
+  requiredSecrets: ["TURNSTILE_SECRET_KEY"],
+  runtimeDeps: [],
+});

package/src/captcha/verify.ts

@@ -0,0 +1,71 @@
+/**
+ * The server half of the bot check: the generated assistant route verifies
+ * the token the browser sent with the question against the provider before
+ * it calls the model. A failed or unreachable check refuses the question
+ * (and logs why), so a server that can't reach the provider shows up as a
+ * refused question rather than a silently unprotected route.
+ */
+import { clientAddressOf } from "../core/client-address.ts";
+import type { ClientContext } from "../core/client-address.ts";
+import { HCAPTCHA_VERIFY_URL } from "./hcaptcha.ts";
+import type { CaptchaAdapter } from "./schema.ts";
+import { TURNSTILE_VERIFY_URL } from "./turnstile.ts";
+
+/** The longest token either provider issues, with room to spare. */
+const MAX_TOKEN_LENGTH = 4096;
+
+/** What the provider answers about a token. */
+interface VerifyReply {
+  "error-codes"?: string[];
+  success?: boolean;
+}
+
+/** What the route hands the check from its runtime. */
+export interface VerifyOptions {
+  /** For tests; defaults to the global `fetch`. */
+  fetch?: typeof fetch;
+  /** The provider's secret key. */
+  secret: string;
+}
+
+/**
+ * Whether the provider confirms `token` came from a person on this site. The
+ * route passes the request body's `captcha` when it's a string.
+ */
+export const verifyCaptcha = async (
+  adapter: CaptchaAdapter,
+  token: string | undefined,
+  context: ClientContext,
+  options: VerifyOptions
+): Promise<boolean> => {
+  if (!token || token.length > MAX_TOKEN_LENGTH) {
+    return false;
+  }
+  const form = new URLSearchParams({ response: token, secret: options.secret });
+  const address = clientAddressOf(context);
+  if (address) {
+    form.set("remoteip", address);
+  }
+  if (adapter.kind === "hcaptcha") {
+    form.set("sitekey", adapter.options.siteKey);
+  }
+  try {
+    const response = await (options.fetch ?? fetch)(
+      adapter.kind === "hcaptcha" ? HCAPTCHA_VERIFY_URL : TURNSTILE_VERIFY_URL,
+      { body: form, method: "POST" }
+    );
+    // SAFETY: both providers answer JSON with a `success` flag; anything
+    // else reads as a failure below.
+    const reply = (await response.json()) as VerifyReply;
+    if (reply.success === true) {
+      return true;
+    }
+    console.warn(
+      `The ${adapter.kind} check refused a question:`,
+      reply["error-codes"] ?? response.status
+    );
+  } catch (error) {
+    console.error(`The ${adapter.kind} check could not be reached:`, error);
+  }
+  return false;
+};

package/src/cli/args.ts

@@ -1,3 +1,5 @@
+import picomatch from "picomatch";
+
 import { logger } from "./log.ts";
 
 const MAX_PORT = 65_535;
@@ -22,6 +24,55 @@ export const parsePort = (value?: string): number | undefined => {
   return port;
 };
 
+/**
+ * Every value a repeatable string flag was given (`--ignore a --ignore b`), in
+ * order. citty 0.2 parses with `node:util.parseArgs` without its `multiple`
+ * option, so the parsed `args` keep only the last value; this reads the raw
+ * arguments the way that parser does instead: `--name=value`, or `--name`
+ * followed by the next token whatever it looks like (`""` when there is
+ * none), and nothing after a bare `--`.
+ */
+export const repeatedFlag = (
+  rawArgs: readonly string[],
+  name: string
+): string[] => {
+  const flag = `--${name}`;
+  const values: string[] = [];
+  for (let index = 0; index < rawArgs.length; index += 1) {
+    const arg = rawArgs[index];
+    if (arg === "--") {
+      break;
+    }
+    if (arg === flag) {
+      values.push(rawArgs[index + 1] ?? "");
+      index += 1;
+    } else if (arg?.startsWith(`${flag}=`)) {
+      values.push(arg.slice(flag.length + 1));
+    }
+  }
+  return values;
+};
+
+/**
+ * The `--ignore` globs of `blume validate` and `blume audit`, as a test for
+ * the external URLs they skip: any glob matching the full URL skips it, with
+ * `dot` set so `**` also crosses a segment like `/.well-known/`. No globs skip
+ * nothing. An empty one (`--ignore` with nothing after it) exits with an
+ * error: it names no URL, and picomatch throws on it.
+ */
+export const parseIgnoreFlag = (
+  rawArgs: readonly string[]
+): ((url: string) => boolean) => {
+  const globs = repeatedFlag(rawArgs, "ignore");
+  if (globs.includes("")) {
+    logger.error(
+      'Invalid --ignore "": pass a glob for the URLs to skip (e.g. --ignore "https://example.com/**").'
+    );
+    process.exit(1);
+  }
+  return picomatch(globs, { dot: true });
+};
+
 /**
  * The longest `--timeout` a timer can hold, in seconds. Node clamps a
  * `setTimeout` delay above 2^31−1 ms (about 24.8 days) to 1 ms, so a larger